uqmi-git

LOW

maintainer dreieck 0 votes scanned 2026-09-23 00:28:13.505974

View on AUR

Why flagged

The source is a git checkout from the project's official OpenWrt repository, which is a legitimate and expected source for this package; building from a non-whitelisted but project-owned host is normal for AUR packages and poses low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the project's official OpenWrt repository, which is a legitimate and expected source for this package; building from a non-whitelisted but project-owned host is normal for AUR packages and poses low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${_gitname}::git+https://git.openwrt.org/project/${_gitname}.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2# Contributor (umbim-git): Jared Baldridge <jrb@expunge.us>
    
      3
    
      4_pkgname=uqmi
    
      5pkgname="${_pkgname}-git"
    
      6_gitname="${_pkgname}"
    
      7pkgver=r191.7914da4
    
      8pkgrel=1
    
      9pkgdesc='OpenWrt QMI modem utility'
    
      10url='https://git.openwrt.org/project/uqmi.git'
    
      11arch=('i686' 'x86_64' 'armv5te' 'armv6' 'armv7' 'armv8' 'aarch64')
    
      12license=('GPL-2.0-or-later')
    
      13depends=(
    
      14  'glibc'
    
      15  'json-c'
    
      16  'libubox'
    
      17)
    
      18makedepends=(
    
      19  'git'
    
      20  'cmake'
    
      21  'gcc'
    
      22  'make'
    
      23  'patch'
    
      24  'pkg-config'
    
      25)
    
      26conflicts=("${_pkgname}")
    
      27provides=("${_pkgname}=${pkgver}")
    
      28source=(
    
      29  "${_gitname}::git+https://git.openwrt.org/project/${_gitname}.git"
    
      30  '001-sbin-fix.patch'
    
      31)
    
      32sha256sums=(
    
      33 'SKIP'
    
      34 '9ca8dc8eff58f6c01029a1f663bf232f10b48ca078f6c325236042fa13f7dac5'
    
      35)
    
      36
    
      37pkgver() {
    
      38  cd "$srcdir/$_gitname"
    
      39  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      40}
    
      41
    
      42prepare() {
    
      43  cd "$srcdir/$_gitname"
    
      44  patch -p1 -i "$srcdir/001-sbin-fix.patch"
    
      45
    
      46  git log > git.log
    
      47}
    
      48
    
      49
    
      50build() {
    
      51  cd "$srcdir"
    
      52  _CFLAGSADDITIONS+=" -Wno-dangling-pointer"
    
      53  CFLAGS+="${_CFLAGSADDITIONS}"
    
      54  CXXFLAGS+="${_CFLAGSADDITIONS}"
    
      55  export CFLAGS
    
      56  export CXXFLAGS
    
      57  cmake -S "${_gitname}" -B build \
    
      58    -DCMAKE_INSTALL_PREFIX=/usr
    
      59  make -C build
    
      60}
    
      61
    
      62package() {
    
      63  cd "$srcdir"
    
      64  make -C build DESTDIR="$pkgdir" install
    
      65
    
      66  install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgname}" "${_gitname}/git.log"
    
      67}
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-23 00:28
@@ -26,7 +26,7 @@
 conflicts=("${_pkgname}")
 provides=("${_pkgname}=${pkgver}")
 source=(
-  "${_gitname}::git+git://git.openwrt.org/project/${_gitname}.git"
+  "${_gitname}::git+https://git.openwrt.org/project/${_gitname}.git"
   '001-sbin-fix.patch'
 )
 sha256sums=(

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 00:28:13	Low	2
2026-09-22 23:39:22	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-19 18:54:17	Clean	2
2026-06-18 16:11:54	Medium	1